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IN THE CLAIMS 

For the convenience of the Examiner, all pending claims of the present AppUcation 
are shown below in numerical order whether or not an amendment has been made. 

1 . (Previously Presented) A method for detecting and removing maUcious code 
from a computer system, comprising: 

determining an operating system of the computer system; 

determining a memory scanning pattern specific to the determined operating system 
for scanning a memory of the computer system for malicious code; 

scanning the computer system for malicious code according to the memory scanning 

pattem. 

2. (Previously Presented) The method of claim 1, further comprising: 
removing detected malicious code from the computer system. 

3. (Previously Presented) The method of claim 1, fiirther comprising 
displaying a message to a user identifying detected malicious code. 

4. (Original) The method of claim 1, ftirther comprising displaying a message 
to a user indicating the presence of malicious code in the computer system. 
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5. (Original) The method of claim 2, wherein the removing step further 
comprises retrieving from a data file, information relating to the detected malicious code, 
including at least one command for restoring the computer system to a state that existed prior 
to modification by the maUcious code and executing the at least one command for restoring 
the computer system to substantially a state that existed prior to modification by the 
malicious code. 

6. (Original) The method of claim 5, wherein the data file is retrieved based on 
a command from the user. 

7. (Original) The method of claim 1, wherein the scanning step further 
comprises scanning a memory of the computer system in accordance with a memory layout 
associated with the determined operating system. 

8. (Original) The method of claim 1, wherein the scanning step comprises 
dividing memory locations of the computer system into a plurality of memory blocks and 
scanning predetermined memory blocks in accordance with the determined operating system. 

9. (Original) The method of claim 6, wherein selected memory blocks are not 
scanned in accordance with the determined operating system. 



DAL01:1037359.1 



ATTORNEY DOCKET NO. 
063170.6813 



4 



PATENT APPLICATION 
SERIAL NO. 10/615,053 



10. (Previously Presented) A storage medivun including computer executable 
code for detecting and removing malicious code from a computer system, comprising: 

code for determining an operating system of the computer system; 

code for determining a memory scanning pattem specific to the determined operating 
system for scanning a memory of the computer system for malicious code; 

code for scanning the computer system for malicious code according to the memory 
scanning pattem; and 

code for detecting the malicious code. 

1 1 . (Original) The storage medium of claim 10, further comprising: 
code for removing the malicious code from the computer system. 

12. (Original) The storage medium of claim 10, ftirther comprising code for 
displaying a message to a user identifying the malicious code. 

13. (Original) The storage medium of claim 10, fiirther comprising code for 
displaying a message to a user indicating that the mahcious code is present on the computer 
system. 

14. (Previously Presented) The storage medium of claim 11, wherein the code 
for removing the malicious code frulher comprises: 

code for retrieving from a data file, information relating to the malicious code 
including at least one command for restoring the computer system to substantially a state that 
existed prior to modification by the malicious code and executing the at least one command 
for restoring the computer system to substantially a state that existed prior to modification by 
the malicious code after the message identifying the malicious code is displayed to the user. 

15. (Original) The storage medium of claim 14, wherein the code for retrieving is 
implemented in response to a command from a user. 
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16. (Original) The storage medium of claim 10, wherein the code for scanning 
further comprises code for scanning a memory of the computer system according to a 
memory layout associated with the determined operating system. 

17. (Original) The storage medium of claim 10, wherein the code for scanning 
further comprises code for dividing memory locations of the computer system into a plurality 
of memory blocks and scanning predetermined memory blocks in accordance with the 
determined operating system. 

18. (Previously Presented) The storage medium of claim 17, wherein the code 
for scanning further comprises code for determining selected memory blocks that are not 
scanned in accordance with the determined operating system. 
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19. (Currently Amended) Software stored on a tangible computer-readable 
storage m edia for detecting and removing malicious code from a computer system, the 
computer system operable when executing the software to perform the following steps, 
comprising: 

determining an operating system of the computer system; 

determining a memory scanning pattem specific to the determined operating system 
for scaiming a memory of the computer system for malicious code ; 

scanning the computer system for malicious code according to the memory scanning 
pattem; and 

detecting the malicious code. 

20. (Previously Presented) The software of claim 19, fiirther comprismg the 
steps of: 

removing the malicious code. 

21. (Previously Presented) The software of claim 19, further comprising the 
steps of displaying a message to a user identifying the malicious code. 

22. (Previously Presented) The software of claim 19, fiirther comprising the 
steps of displaying a message indicating to a user that malicious code is present in the 
computer system. 

23. (Previously Presented) The software of claim 20, wherein removing the 
malicious code fiirther comprises: 

retrieving from a data file, information relating to the malicious code including at 
least one command for restoring the computer system to a state that existed prior to 
modification by the malicious code and executing the at least one command for restoring the 
computer system to substantially a state that existed prior to modification by the malicious 
code. 

24. (Previously Presented) The software of claim 23, wherein the data file is 
retrieved in response to a command from a user. 
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25. (Previously Presented) The software of claim 19, fiirther comprising the 
steps of scanning a memory of the computer system in accordance with a memory layout 
associated with the determined operating system. 

26. (Previously Presented) The software of claim 19, wherein the scanning 
fiirther comprises dividing memory locations of the computer system into a plurality of 
memory blocks and scanning predetermined memory blocks in accordance with the 
determined operating system. 

27. (Previously Presented) The software of claim 26, wherein the scanning 
fiirther includes determining selected memory blocks that are not scanned, based on the 
determined operating system. 
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28. (Previously Presented) A system for detecting and removing malicious code 
from a computer system, comprising: 

an identifying device adapted to determine an operating system of the computer 

system; 

a determining device adapted to determine a memory scanning pattern specific to the 
determined operating system for scanning a memory of the computer system for mahcious 
code; 

a scanning device adapted to scan the computer system for malicious code according 
to the memory scanning pattem; and 

a code identifying device adapted to detect the malicious code. 

29. (Previously Presented) The system of claim 28, wherein the memory 
scanning pattem identifies one or more portions of the memory that are imused by the 
determined operating system and indicates that the unused portions are to be left unscanned. 

30. (Previously Presented) The system of claim 28, wherein the memory 
scanning pattem optimizes scanning the computer system for malicious code by identifying 
portions of the memory that are unsusceptible to malicious code ("unsusceptible memory 
portions") due to treatment of the unsusceptible memory portions by the determined 
operating system and indicates that the unsusceptible memory portions are to be left 
imscanned. 

3 1 . (Previously Presented) The system of claim 28, wherein the scanning device 
is adapted to scan the computer system for malicious code by searching for viral signatures in 
the memory. 
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32. (Previously Presented) The system of claim 29, wherein the code removal 
device further comprises: 

a retrieving device adapted to retrieve one or more restoration data files specific to a 
detected malicious code including at least one command for restoring the computer system to 
a state that existed prior to modification by the detected malicious code; and 

an execution device adapted to execute the at least one command for restoring the 
computer system to substantially the same state as it existed prior to modification by the 
detected malicious code. 

33. (Previously Presented) The system of claim 28, wherein the memory 
scanning pattern identifies a memory layout specific to the determined operating system and 
uses the memory layout to identify portions of the memory that are unsusceptible to 
malicious code. 

34. (Original) The system of claim 28, wherein the scanning device further scans 
a memory of the computer system in accordance with a memory layout associated with the 
determined operating system. 

35. (Original) The system of claim 28, wherein the scanning device divides 
memory locations of the computer system into a plurality of memory blocks and scans 
predetermined memory blocks in accordance with the determined operating system. 

36. (Original) The system of claim 35, wherein the scanning device does not 
scan selected memory blocks based on the determined operating system. 
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